Stored Cross-Site Scripting in WP SPID Italia Plugin for WordPress

CVE-2024-11758

What is CVE-2024-11758?

The WP SPID Italia plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) flaw via its shortcode functionality. This vulnerability exists in all versions up to and including version 2.9 due to inadequate input sanitization and output escaping for user-supplied attributes. Authenticated attackers with contributor-level permissions or higher can exploit this weakness, allowing them to inject arbitrary web scripts into pages. The malicious scripts are executed whenever a user accesses the compromised page, posing a significant security risk to users and the integrity of the site.

References